9b1de37baf25d4f3817467948343ab480095b8536e382ccd753a088c4e030f63

Analysis

max time kernel
117s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c03bc9a2583d56ba1523af1f860018d5_JaffaCakes118.html
Size

63KB
MD5

c03bc9a2583d56ba1523af1f860018d5
SHA1

dcf68015ac2c1b24bfd54693c765d5a584a4ffb3
SHA256

9b1de37baf25d4f3817467948343ab480095b8536e382ccd753a088c4e030f63
SHA512

8d5fe0d53acfe2aef2563ab3edb5d2e8fa797aaa5adbd6759134bf61ee7fc967d1ce46621ddcf1a598e8e3a9ffae67278978ba0baf8c5c0de21f5413fe6851dd
SSDEEP

768:61ipKVAqnd+qq9o7B2L0mKUOHjh2lAch2lAs/COX3VO2iaJv:61IKVhnd+xmBA0mTAjELE2OX3Vl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B64080A1-62B2-11EF-B9AB-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602d2d8fbff6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000024b7ca5d87c27df0df0557f802e097655d964a5753e77156c3e7d4986459d42e000000000e8000000002000020000000c505cf2d672ad40786884518c77b94460589d38eb1de85f7c2f7a4c1be40361f900000006a8cacd5e1c62d9400f786025ac68d5df80b5ede2842e1b07ea7fe999c627c4b3c9f2ea8e9c62140b3be40fc85154f084fb072a370a3a43c150bf2976747700df94957233db8fcc6e1a2a07e451ce5c4fd44b06d0c7de300136b33865c99fa166e916e8dc0659247d32878e837c29462944167a3d6560cc33dbb65958de035022e4cc5f253ec26b42713b21181081a234000000064b9e23db9d07abb508024002d8f62d5c781dae2a5be09f7f97395cac69781b08725f2215ffc78103554d2c235d749d0110c7b3ef21cff4bbcee9e4f581a6bd4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430732406"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000008b574421b124ff011ad24fcae3899122f5d0a2b33a9b1c49f89ef97e64100261000000000e80000000020000200000002e1bcf16046c9c07966d7c84b6c426a3c36446da4389d90a6409c0bfa2147508200000000bab2b6b5840f5660e53f499c2f234ea705990cea7655dc657c5b76b1b034c6c40000000a0a3a78b80c35c3cb84310fd16dea91b3a9ac3e0cf847666b59da9bdf916e795caaa21ed0acdf18536c5e1dbafb293c30c59795992fe1edc7ebca4acc962b59f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2056	2232	iexplore.exe	30
PID 2232 wrote to memory of 2056	2232	iexplore.exe	30
PID 2232 wrote to memory of 2056	2232	iexplore.exe	30
PID 2232 wrote to memory of 2056	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c03bc9a2583d56ba1523af1f860018d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1aa607fcc86dc218e04febbf0484b0c8

SHA1
04ff72f900cfca65306f61aabd4b6ea337740961

SHA256
02cf8ed5e9267c2b9658c3e07951626d85e6f5ebb3eb032e58abd347bba18199

SHA512
a2f99e445d78c1107d1c000c639fa988f71faf51ebd2a35f7ae55c8fc7160798b51c3e5de69ed99b25c5bd31c31df9508b161c31ce778b548fbdeb2aafdca1c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD

Filesize
471B

MD5
4e36679b90f2b4bac0f6f68eb69c60b9

SHA1
c19f5f5a46e90073c676608d6b8500f0c43cde5e

SHA256
655b9ec49bea0f1633cb85af4196827a043da6e89febd48ac14b1f97f4081314

SHA512
58abbc2be83a85641f1022bac1968bd02cf34cbae8a6c812e6d222576278c172b1ede7f58c8234b780ec4bb47344d20a3c7310c0dafd1ab303fb17e747d5222c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
b0b79a1edbf7395ad7c78febc5f0e9b0

SHA1
c7b2d7d63a13076df0766cb2b353b9141b750a36

SHA256
6f80f0c7f1ea9696489b6431fec2670d4677c15b1f387487b4a9ac4cc7eb091b

SHA512
e525f49667d60ebf981e4769902911bd51ee9bd0f50beb00470d39ae0cb40f286964e238bdf8893904a9f258ab2897dee3cf2635265a34e6875f005b1af08dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9fa8f26edcb6d70e2edea07238e38183

SHA1
940262152e42aabc50fe7611c4b526236bc54b86

SHA256
6bd7f60d8d0e964bc0e7a76fd62ad0d6d992db1aae9761aed43041d8da8f7abc

SHA512
4111fed2e4c630a5d3af780f0f8bdfb53cc143b0be7095471eb83d6479e0628755b7153d5422388b8b47d48477bcd16467f745dbeb194218dad10cf9c5ee08f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
f8be81a296a092cbf412610902f8ad4f

SHA1
c07179539a54d92ef7c9b3cf7e24fb35b51c61ff

SHA256
695eaff52ca064659eab5f396e7cc24d7beb21d491ea7fe6eb513e13f39b1952

SHA512
5a96a261f379609777ee3d7260551839c322c34526164460e60b60ffd28ad1c840f5524336c18af6dcd6f2a6ef2baf282289a631701c4ae270996932e52708da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
df0ae83fe58b41af91b76599f5fad74d

SHA1
f51c02a47484490b066be6b128ab438a843d99d7

SHA256
2b861056a201dec08a0ab9172d58012d47fc540af5eeb84f9be39b7c03954baf

SHA512
fb149e14860663fb92e43c7950870d221717166d007aad50dc764d6c0258c5d5df62c3921934461bfd34ce675de11230275d8f7bbf5f0d0ea196ce594a0744e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
30df2c322cc50bd391d1d79fb022d54f

SHA1
a6ef64d937502b7a91739132de7c45bd24e00d38

SHA256
20cf5b6539d569badb74a1ef1328c87c51e93779485a7c026db837392a676734

SHA512
8865e991a0d7124161ec86e4b0872faa7475f5989ce7c7c6ed2df786760152eb9f5e383dc4feb03612a0d6d2ec2bb79e3eea3e891ccfc87b468ab314b07e7b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65395df69a8e1516c086badc23c7009d

SHA1
f9a286aa7b374d63780456ae732b52cc09f35ebd

SHA256
d4a6bfc503d490c33efbfd028797e17187c883e4ed60f6316de28f6cff8345ef

SHA512
13cd191a5f9a18580411650f2e17b3f04596edb0759ce0c21b83fd28a6cafac61eaf8e28ab6dac5f343c3e3a4b49bbdc82d2db3d1f678890bff1addf4757ba7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f82267b71ae8ee90a8b9848c7b4b5674

SHA1
7a14aa4fc0a2e5cf09435ce0c7d3e830cb5bbe75

SHA256
e019bd12873ee7b4a93a1ca2dfef491f427abdac17f8c37da6d36ce818663113

SHA512
013548cfb8104fec235449c6a1e05a1e96f2bd7c6c0ed96b773e09e4b2f7c3ec64dc8f5a056af99346b6d809e8cdec8e362cee2543dded663daeaac5f36b8ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6AF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF72F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit